Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Microsoft Sentinel SOC Operations

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel

Repository with Sample KQL Query examples for Threat Hunting

Parse pfSense/OPNSense logs using Logstash, GeoIP tag entities, add additional context to logs, then send to Azure Sentinel for analysis.

A collection of things I've created or found that I think is useful for Azure Sentinel.

A technical blog about Kusto

Collection of Azure Monitor or Sentinel Kusto Queries

This terraform module is designed to create azure Sentinel resources. Microsoft Sentinel natively incorporates proven Azure services, like Log Analytics and Logic Apps. Microsoft Sentinel enriches your investigation and detection with AI. It provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence

Microsoft Sentinel / Azure Open AI 演習のレポジトリです。

Collection of Azure Sentinel - Playbook | Logic App (Template)

Azure ARM (bicep) template for deploying a high availability syslog/CEF forwarder setup using Azure VMs.

A containerized Logstash ready to send data to Log Analytics or Event Hub

This project used for convert azure sentinel rules to excel

Microsoft related PowerShell scripts and KQL queries

Simple KQL query that can be run either in MD for Endpoint (Threat hunting or Custom indicator) or in Azure Sentinel (Threat hunting or analytics rule).It's looking for 4 known IOCs related to the Kaseya attack

AutoClosing-SAMPLEALERT-FromMDfC

This repository provides summarization Schedule Analytics Rules in Sentinel Incident

MaxMind Geo and ASN Data for Kusto

Threat-Hunting KQL query which identifies machines that utilize powershell, cmd or wmic to connect to any URL that includes “cdn.discordapp.com” ,where the action was initiated by a script execution ( .vbs , .bat etc)